Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
979 detections
Filters
Last updated
All Time
Detection languages
467
248
152
48
27
Contributors
196
172
133
106
90
Categories
463
262
226
216
121
Platforms
968
2
2
1
1
Products / Services
321
203
165
53
46
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
979
CVEs
5
2
1
1
1
IDS Classtypes
2
IDS Protocols
2
This analytic detects the addition of new InProcServer32 registry keys on Windows endpoints. Malware often uses this mechanism to achieve persistence or execute malicious code by registering a new InProcServer32 key pointing to a harmful DLL. If confirmed malicious, this could allow an attacker to persist in the environment or execute arbitrary code, posing a significant threat to system integrity and security.
Detects modification of the registry settings used for Internet Explorer and other Windows components that use these settings. An attacker can abuse this registry key to add a domain to the trusted sites Zone or insert JavaScript for persistence
This analytic detects attempts to modify the Windows Registry to change a network profile's category to "Private". This modification, specifically setting the 'Category' value to '1' within the 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles\{GUID}' registry path, typically enables less restrictive firewall policies. Adversaries may perform this action to facilitate lateral movement or reduce security restrictions. While legitimate network configuration can involve this change, its occurrence outside standard IT processes or correlated with other suspicious activities (like unusual account activity, administrative privilege usage, or execution of unsigned binaries) can indicate malicious post-exploitation behavior.
The following analytic detects attempts to modify the Windows Registry to change a network profile's category to "Private", which may indicate an adversary is preparing the environment for lateral movement or reducing firewall restrictions. Specifically, this activity involves changes to the Category value within the HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles\{GUID} registry path. A value of 1 corresponds to a private network profile, which typically enables less restrictive firewall policies. While this action can occur during legitimate network configuration, it may also be a sign of malicious behavior when combined with other indicators such as suspicious account activity, unexpected administrative privilege usage, or execution of unsigned binaries. Monitoring for this registry modification—especially outside standard IT processes or correlated with persistence mechanisms—can help identify stealthy post-exploitation activity.
Detects changes to the Internet Explorer "DisableFirstRunCustomize" value, which prevents Internet Explorer from running the first run wizard the first time a user starts the browser after installing Internet Explorer or Windows. This registry modification can be used by adversaries for defense evasion, potentially to suppress pop-ups that might alert a user to unusual browser behavior or to streamline the execution of malicious activities without user interaction.
Detects the deletion of AMSI provider registry key entries in HKLM\Software\Microsoft\AMSI. This technique could be used by an attacker in order to disable AMSI inspection, which is a defense evasion technique.
Detects registry modifications associated with the Gentlemen ransomware group. These changes are intended to weaken security controls for NTLM, Remote Desktop Protocol (RDP), and administrative access to facilitate lateral movement and persistence.
Detects the modification of the 'UserInitMprLogonScript' registry key to execute a PowerShell script with a hidden window. This persistence technique was used by the COLDRIVER APT group.
Detect the creation of a service with a service binary located in a suspicious directory
Detects the execution of commands via the Windows Run dialog box by monitoring modifications to the `RunMRU` registry key. This technique is often abused by threat actors to trick users into pasting and executing malicious commands, sometimes disguised as CAPTCHA verification steps. The rule filters out common legitimate entries to reduce false positives.
The analytic detects modifications to the Windows registry entry "DisableRestrictedAdmin," specifically when its value is set to 0x00000000. This action disables the Restricted Admin mode, a security feature that limits credential exposure during remote connections. Monitoring this activity is crucial as changes to this setting can weaken security controls, increasing the risk of credential theft and unauthorized access to sensitive systems. This detection leverages registry activity logs from endpoint data sources like Sysmon.
The ZoneMap key under Internet Settings is used to define security zones for specific domains. By setting a value under ZoneMap\Domains, you are configuring how Windows handles security and permissions for that domain so it is really helpful to identify if some site has been added via cli manually or by some malicious script to whitelist some domains and bypass some defense.
On environments managing sensible or critical information, I am not really happy when their local device configuration are modified and their network rely on airports, hotels, or the nearest coffee shop's Wi-Fi. This Query review if the TCPIP register is modified and it DHCP Domain is managed by a non-trusted/known network. It would help to restrict their access to enterprise data until be 100% sure they are using a VPN or back to enterprise DHCP Domain.
This rule detects various activities associated with the NotDoor malware, including the copying of malicious files to Outlook macro folders, C2 beaconing attempts using nslookup or curl to suspicious domains, registry modifications to disable Outlook macro security or enable macro loading on boot, and the creation of staging files in temporary directories for potential exfiltration. These behaviors are indicative of NotDoor installation, persistence, defense evasion, and data staging.
The analytic detects the modification of the Windows Registry key "LoadMacroProviderOnBoot" under Outlook. This enables automatic loading of macros, which could allow malicious scripts to run without notice. This detection leverages data from the Endpoint.Registry datamodel to search for this key being enabled. This activity is significant as it is commonly associated with some malware infections, indicating potential malicious intent to harvest email information.
The analytic detects the modification of the Windows Registry key "PONT_STRING" under Outlook Options. This disables certain dialog popups, which could allow malicious scripts to run without notice. This detection leverages data from the Endpoint.Registry datamodel to search for this key changing from an unusual process. This activity is significant as it is commonly associated with some malware infections, indicating potential malicious intent to harvest email information.
This analytic detects the modification of the Windows Registry key "Level" under Outlook Security. This allows macros to execute without warning, which could allow malicious scripts to run without notice. This activity is significant as it is commonly associated with some malware infections, indicating potential malicious intent to harvest email information.
Looking for several activities that are documented as being part of the initial infection chain for NotDoor (https://lab52.io/blog/analyzing-notdoor-inside-apt28s-expanding-arsenal/).
Nice as a quick historical check for any potentially interesting things to investigate further.
Nice as a quick historical check for any potentially interesting things to investigate further.
Detects registry modifications associated with the NotDoor backdoor used by APT28. The malware modifies Outlook registry keys to enable macros on boot, lower security settings, and disable dialog messages to achieve persistence and evade user detection.
Detects scenarios where an attacker attempts to register the SMBexec service to estasblish persistence.
Detects scenarios where an attacker modifies registry permissions on a local or remote target in order to introduce a backdoor and dump hashes and credentials.
Page 30 of 47